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Abstract 



\l ' Quantum digital signature combines quantum theory with classical digital signature. The main 

(N 



goal of this field is to take advantage of quantum effects to provide unconditionally secure signature. 
We present a quantum signature scheme with message recovery without using entangle effect. The 
most important property of the proposed scheme is that it is not necessary for the scheme to use 
Greenberger-Horne-Zeilinger states. The present scheme utilizes single photons to achieve the aim 
. of signature and verification. The security of the scheme relies on the quantum one-time pad and 

quantum key distribution. The efficiency analysis shows that the proposed scheme is an efficient 
scheme. 
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^ ■ 1 Introduction 



Quantum cryptography is a cryptographic system using quantum effects to provide unconditionally se- 
cure information exchange. Many advances have been made in quantum cryptography in recent years, 
, including quantum key distribution (QKD)[3, 4, 5], quantum secret sharing[6], quantum authentication 

' and quantum signature[l, 2, 7, 8, 9, 10]. Classical digital signature is the basis of realizing identity au- 

thentication, data integrity protection and non-repudiation services. Because classical digital signature is 
not unconditionally secure, some quantum signature schemes are proposed in recent years[l, 2, 8, 9, 10]. 
Quantum digital signature combines quantum theory with classical digital signature and utilizes quantum 
effects to achieve unconditional security. 

Gottesman and Chuang proposed a quantum signature scheme based on quantum one-way functions 
and quantum Swap-test [8] . However, their scheme is an inefhcient scheme. Zeng and Christoph proposed 
an arbitrated quantum signature scheme whose security based on the correlation of the Greenberger- 
Horne-Zeilinger (GHZ) triplet states and the use of quantum one-time pad[l]. Lee et al. proposed two 
quantum signature schemes with message recovery [2]. Lee's schemes also use GHZ triplet states, qubit 
operations and quantum one-time pad to generate and verify the signature. Lii and Feng presented two 
quantum signature schemes, one scheme based on quantum one-way functions and the other based on 
GHZ triplet states and quantum stabilizer codes[9, 10]. 

Most of the proposed quantum signature schemes use entangle effect to achieve the aim of signature 
and verification. In this paper, we present a quantum signature scheme with message recovery without 
using entangle effect. The communication parties utilize single photons to perform signature and verifi- 
cation with the help of an arbitrator. The security of our scheme relies on quantum one-time pad and 
quantum key distribution proved as unconditionally secure[ll, 12]. Because our scheme does not need 
to distribute the GHZ particles and only needs von Neumann measurement, our scheme provides higher 
efficiency. 
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2 Description of our quantum signature scheme 

Our scheme is composed of three parts: initial phase, signature phase and verification phase, involving 
three participators, the signatory Alice, the receiver Bob and the arbitrator. In the initial phase, the 
arbitrator distributes secret information to each Alice and Bob. In the signature phase, Alice generates 
her signature in association with the message qubits, the secret information and qubit operations. In the 
verification phase. Bob verifies Alice's signature with the help of the arbitrator. 

Both QKD and quantum one-time pad play important roles in our scheme. Wc use QKD protocol, 
such as BB84 or B92 protocol to distribute the secret information. The encryption algorithm used in 
our scheme is quantum one-time pad described in [13]. We select a set of M unitary operations {Uk}, 
k = 1, • • • , M. The key k is chosen with probability pk and the message state is p. Then we obtain the 
cipher state pc, where pc = Y^PkUkpUl = -^I. 

k 

2.1 Initial Phase 

Alice and Bob share secret keys Ka, Ki, with the arbitrator, respectively. These keys are assumed to be 
distributed via QKD protocol. The arbitrator generates two random secret bit strings A and B, where 
A = {Ai,A2, • • • , An}, B = {J5i, J52, • • • , -B„}, Ai,Bi{i = 1, 2, • • • , n) e {0, 1}, as authentication keys and 
distributes the two strings to each Alice and Bob via QKD protocol. 

2.2 Signature Phase 

In the signature phase, Alice signs her message |P) and obtains her signature \S). 

Stepl: At the beginning, Alice prepares a string of message qubits \P) = {\pi), \P2), ■ ■ ■ , \Pn)}, where 
any qubit \pi) (z = 1, 2 • • • , n) in \P) is one of the two eigenstates |0), \P) may be presented by classical 
bits. We represent the message string as qubits so that the signature can be transmitted through quantum 
channel. 

Step2: In this step, Alice transforms the massage qubits \P) into state \M) according to A. If Ai = 0, 
Alice does nothing to \pi), otherwise she applies bit flip gate 




to \pi). Then after Alice's qubit operations, she obtains 

\M) = {|mi),|m2),---,|m„)} = {|Ai ©pi), 1^2 ® P2), • • • , ©Pn)}- 

Step3: In this step, Alice transforms the massage qubits \P) into state \R) according to Ka- If Ka — 0, 
Alice uses rectilinear measurement basis {| —^), \ "f)}. If = 1, Alice uses diagonal measurement basis 
{| /')) I \)}- Then |0), |1) of the message qubits \P) are represented by | and | t) in the rectihnear 
measurement basis and by | y) and | \) in the diagonal measurement basis, respectively. Alice obtains 

\R)=MKjP) = {\n),\r2),---,\rn)}, 

where jr^) = \Pi)('i- = 1, 2, • • ■ , n). 

Step4: Alice obtains the quantum signature \S) for the message qubits \P) by encrypting |M) and 
the secret qubits \R) with the key Ka- 

\S) = EkA\M),\R)}. 
Step5: Alice sends the signature IS') to Bob through a quantum channel. 
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2.3 Verification phase 

In the verification phase, Bob verifies Ahce's signature \S) with the help of the arbitrator. 

Stepl: After receiving the signature \S), Bob encrypts l^) and B with the key Ki, and obtains 

\N)=EkA\S),B}. 

Then he sends |A'') to the arbitrator. 

Step2: The arbitrator decrypts \N) with the key Kb and obtains IS'), B'. Then he decrypts \S) with 
the key Ka and obtains |M), \R). 

Step3: The arbitrator recovers the message |P) with |M) and A for 

|P) = \A®M) = {\Ai e mi), \A2 e rnz), • • • , m„)}. 

The arbitrator then generates |i?g) using \P) and iiTa according to the methods of the third step in 
the signature phase. He compares \R'g) with \R) and generates a verification parameter 7. If |i?^) = \R), 
he sets 7 = 0, otherwise 7=1. The arbitrator also compares B' with B and generates parameter ^. If 
B' = B, he sets ^ = 0, otherwise ^ = 1. The arbitrator transforms the message qubits |P) into |i?^), 
where |ii^) = M^JP), using Kb- He also generates \U) = |P ® P) using B and |P). 

Step4: The arbitrator encrypts 7, ^, |J7), |P^) and jS) using the key Kj, and obtains 

\v) = EkAi,^,\u),\K),\s)}. 

Then he sends \V) to Bob. 

Step5: Bob decrypts \V) and obtains 7, ^, |C/), |P[,), jS). If 7 = ^ = 0, he then recovers the message 
qubits by |P) = |P ® f7). Bob generates \R') using |P) and Kb, and compares it with |i?^). If |P') = |P^), 
he accepts the message qubits |P) and the signature \S), otherwise he should reject it. 

3 Security analysis 

The security of signature schemes requires that the signatory can not disavow her signature and the 
signature can not be forged. We demonstrate that our scheme is unconditionally secure as follows. 

3.1 Impossibility of forgery 

Theorem 1. // other entities forge Alice's signature, their cheating will be detected with a probability 
p > 1 1 

Proof. The signature is generated by encrypting the state \R) and |M) with Ka, secretly kept by 
Alice and the arbitrator. Ka is distributed via QKD protocol proved as unconditionally secure. \R), 
\M) arc states, into which Alice transforms the message qubits |P) according to Kg and A, respectively. 
Firstly, we assume that Bob is dishonest and tries to forge Alice's signature. However, \R), \M) and 
Ka are secret for him. Secondly, we assume an attacker. Eve tries to forge Alice's signature. The 
public parameters of our scheme arc \S), \N) and \V), where \S) — Ek^{\M), \R)}, \N) ~ Ek^WS) ,B\, 
\V) = EkbIi, \U}, \Rb), and they do not offer any information of the secret keys. The encryption 
algorithm is quantum one-time pad proved as unconditionally secure. If Bob or Eve randomly selects the 
two strings K'^ and A' to execute the scheme, their cheating will be detected by the arbitrator with a 
probability lager than 1 — 21k^\+\a\ , where \Ka\ and \A\ denote the length of the Ka and A, respectively. 

3.2 Impossibility of disavowal 

Theorem 2. If Alice denies her signature, the arbitrator can judge whether Alice has disavowed her 
signature. 
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Proof. Because the signature \S) contains Alice's key Ka, Alice can not disavow her signature. If 
Alice disavows her signature, Bob only need to send the signature \S) to the arbitrator and the arbitrator 
will judge whether Alice has disavowed her signature. If the signature contains Alice's secret keys, this 
signature has been carried by Alice, otherwise, the signature has been forged by other entities. On the 
other hand. Bob can not deny his receiving of Alice's signature because he needs the help of the arbitrator 
in the verification phase. 

4 Efficiency analysis 

We simply define the efficiency of quantum signature schemes as the formula 77 = B,/ {Qi + Bi), where Bg 
is the number of message qubits signed, Qt and Bt are each the number of qubit transmitted and classical 
bit exchanged in the scheme. In terms of the formula, the efficiency of our scheme. Lee's scheme and 
Zcng's scheme is each 11%, 11% and 9%. However, the formula is just used to simply analyze the efficiency 
of quantum signature schemes. In practice, we should also consider the complexity of realizing a scheme, 
involving the distribution of initial secret information, measurement methods, encryption algorithm, etc. 

Although an arbitrator is not necessary in Gottesman's scheme, it requires a trusted key distribution 
center, which has authenticated links to all three participators. Moreover, M keys are used to sign each bit 
message in Gottesman's scheme. Zeng's scheme requires a joint measurement on each message qubit and 
GHZ particle to generate a four-particle entangled state and n Bell measurement to disentangle message 
qubits and GHZ particles. In Lee's scheme, the signatory and the verifier should also measure their GHZ 
particles and compare qubits strings in the verification phase. Lii's scheme is relatively complicated, 
because the secret keys and the syndromes of quantum stabilizer codes arc each used to encrypt and 
encode the quantum states. Our scheme does not need to use the GHZ triplet states, so it reduces the 
process of distributing and measuring the GHZ particles. In the verification phase, we only need to 
use von Neumann measurement to verify the qubits strings. Compared with these quantum signature 
schemes, our scheme provides higher efficiency. 

5 Conclusion 

In this paper, we propose a quantum signature scheme with single photons. In the initial phase of our 
scheme, secret keys and authentication keys are distributed to each participator via QKD protocol. In 
the signature phase, Alice generates her signature by encrypting the transformed message qubits with 
the secret keys. In the verification phase. Bob verifies Alice's signature with the help of the arbitrator. 
The security analysis showed that our scheme is unconditionally secure. We only need to utilize QKD, 
quantum one-time pad, qubit operations and von Neumann measurement to realize our scheme, so the 
scheme is simple and practicable. Many potential improvements of quantum signature remain largely 
unexplored. The properties of quantum should be fully used to design more practicable quantum signature 
schemes. 
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